/**
 * Sentinel rule ports — Phase C of the ShipSafe × Assay bridge.
 *
 * Deterministic security-claim checkers ported from shipsafe-sentinel's rule
 * catalog (security-agent-dev/src/layers/rules/domains/*). Each port is a
 * SINGLE-FILE presence-of-defect predicate: it fires only on positive evidence
 * found in the one code string the formal verifier can see.
 *
 * DECIDABILITY CONTRACT (the Phase C design constraint):
 *   • Only rules honestly decidable on one file's content are ported. Rules
 *     that need project context (package.json deps, middleware inventory,
 *     config files elsewhere) are NOT ported — on single-file input they can
 *     only produce absence-FAIL false positives, the exact class the
 *     weak-override suppression levers exist to kill.
 *   • A HIT is `sound: true` (positive contradiction — may override an LLM
 *     PASS under the existing override discipline).
 *   • A CLEAN scan is `sound: false` (absence of evidence — corroborates an
 *     LLM PASS but can never flip an LLM FAIL/PARTIAL/UNVERIFIABLE).
 *
 * RELEVANCE GATE: a port only adjudicates claims whose text matches its
 * `claimPattern` — out-of-scope evidence never fails a claim.
 */
import type { ForwardClaim, FormalCheckResult } from '../formal-verifier.js';
import type { SentinelRulePort } from './shared.js';
export type { SentinelDetection, SentinelRulePort } from './shared.js';
export { isSecretShaped, shannonEntropy } from './shared.js';
export declare const SENTINEL_PORTS: SentinelRulePort[];
export interface SentinelRunStats {
    checksRun: number;
    defectsFound: number;
}
/**
 * Run every relevant Sentinel port for one claim against one code string.
 * Returns FormalCheckResults ready to compose in runFormalVerification's
 * conjunctive parent-verdict logic (any sound FAIL ⇒ parent FAIL).
 */
export declare function runSentinelChecks(claim: ForwardClaim, code: string, language: string, stats?: SentinelRunStats): FormalCheckResult[];